Privacy Policy

1. Who This Policy Applies To
This Policy applies to everyone who interacts with the Platform:
(a) Customers — residents, Sarpanch/Panchayat representatives, and other community members who report complaints via WhatsApp;

(b) Technicians & Supervisors — field staff who use the mobile application to manage Work Orders;

(c) Administrators — Company or partner personnel using the web dashboard.

2. Information We Collect (Notice under Section 5, DPDP Act)
Category
Examples
Collected From
Identity & contact
Name, mobile phone number
WhatsApp opt-in, technician/supervisor onboarding by an Administrator
Location
Village/cluster, address notes, free-text location description, GPS coordinates (where shared)
Customer complaint submission, Technician home-village/GPS setup
Complaint content
Issue type, free-text description, connection ID
Customer, entered via WhatsApp
Photos
Complaint photos, inspection photos, completion photos
Uploaded by Customer or Technician through the app/WhatsApp
Verification codes
Visit OTP, completion OTP
Generated by the Platform, shared between Customer and Technician
Service & performance data
Work Order status/history, estimates, materials used, ratings, jobs completed
Generated during the service lifecycle
Payment records
Amount, payment method (cash/UPI), invoice line items
Recorded by Technician/Supervisor at time of service
Device & notification data
Push-notification tokens, basic device/browser information
PWA installation, notification opt-in
Account & access data
Login tokens, role (customer/technician/supervisor/admin), cluster assignment
Platform authentication

We do not knowingly collect financial instrument details (such as card or bank account numbers) —payments referenced above are recorded as transaction summaries, not processed by us as a payment
gateway (see Section 4).

This table constitutes our itemised notice of the personal data collected and the purpose of processing, as required under Section 5 of the DPDP Act. Where we seek your consent (for example, to send WhatsApp
notifications), we will provide this notice in or alongside the consent request, in as many languages as reasonably practicable.

3. How We Collect Information
(a) Via WhatsApp: When you message our WhatsApp Business number to report a complaint, we receive your phone number and the content of your messages through the Meta WhatsApp Cloud
API, subject also to WhatsApp’s own privacy policy.

(b) Via the mobile application (PWA): Technicians and Supervisors provide information directly, and the app may request camera and location permissions to capture inspection/completion photos
and site coordinates.

(c) Via the web dashboard: Administrators enter and manage geography, technician, and inventory data.

(d) Automatically: Basic technical data (e.g. push-notification tokens, session/login tokens) is generated as part of normal Platform operation.

4. How We Use Your Information
We use the information described above to:
1. Log, assign, and track Complaints/Work Orders through to resolution;
2. Match and dispatch an appropriate Technician based on location, cluster, and skill;
3. Verify site visits and job completion via OTP;
4. Send status notifications (e.g. job assigned, estimate ready, work completed) via WhatsApp, push
notification, or in-app;
5. Track SLA performance, escalate at-risk Work Orders, and generate operational/management
reports;
6. Maintain inventory, technician performance, and payment/invoice records for audit and
accountability;
7. Investigate and resolve disputes or grievances raised by a Customer or Technician;
8. Comply with applicable legal, regulatory, or government-reporting obligations.

We do not use Customer or Technician data for unrelated marketing purposes, and we do not sell personal information to third parties.

5. Legal Basis, Notice & Consent
By messaging our WhatsApp number, registering as a Technician/Supervisor, or otherwise using the Platform, you consent to the collection and use of your information as described in this Policy and the notice given at Section 2, in accordance with the DPDP Act, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data
or Information) Rules, 2011, as applicable. Where processing is necessary to fulfil a Work Order you have requested, we rely on that necessity as an additional, “legitimate use” basis for processing under the DPDP Act, separate from consent (for example, to complete a Work Order you have already raised). Consent is free, specific, informed, and may be withdrawn at any time with effect from the time of withdrawal, without affecting the lawfulness of processing carried out before withdrawal (Section 6, DPDP Act). You may withdraw consent using the contact details in Section 14; withdrawal may mean we can no longer provide the specific Service that depended on that consent (for example, we cannot
dispatch a Technician to a Complaint if we are not permitted to share your location with them).

6. Sharing & Disclosure
We share information only as necessary to operate the Platform:
(a) With Technicians/Supervisors — a Customer’s name, phone number, location, and complaint details are shared with the Technician assigned to their Work Order, and with the relevant Supervisor
overseeing that cluster, solely to enable service delivery.

(b) With Gram Panchayats / VWSC / implementation partners — aggregate or Work-Order specific information may be shared with local governance bodies or authorised field partners (such as
Samarthan) involved in delivering the Platform in a given area.

(c) With service providers (data processors) — including Meta (WhatsApp Cloud API) for
messaging, and cloud hosting/storage providers for application infrastructure and photo storage.
These providers process data on our behalf, under contractual obligations consistent with the DPDP Act, and are not authorised to use it for their own purposes.

(d) For legal reasons — where required by law, court order, or governmental authority, or to protect the rights, safety, or property of the Company, our Users, or the public.

(e) In a business transfer — if the Company is involved in a merger, acquisition, or asset sale, User information may be transferred as part of that transaction, subject to this Policy continuing to apply (or a materially equivalent policy).

We do not share Customer or Technician personal information with unrelated third parties for their own marketing purposes.

7. Cross-Border Data Transfer
Some of our infrastructure or service providers (for example, cloud hosting/storage, or Meta’s WhatsApp Cloud API) may process or store data outside India. Under Section 16 of the DPDP Act, cross-border transfer of personal data is permitted except to countries or territories specifically restricted by the Central Government. We will take reasonable steps to ensure any such transfer is made to service providers bound by contractual data-protection obligations consistent with this Policy. [Placeholder: confirm and list the specific hosting/storage region(s) and any transfer safeguards once infrastructure is finalised.]

8. Data Storage & Security
We implement reasonable technical and organisational security safeguards appropriate to the sensitivity of the data we hold, as required under Section 8(5) of the DPDP Act — including encrypted transport,
access-controlled systems, and role-based access limiting Administrators, Supervisors, and Technicians to the data relevant to their role/cluster. No method of electronic storage or transmission is completely
secure, and while we work to protect your information, we cannot guarantee absolute security.

9. Data Breach Notification
In the event of a personal data breach, we will, in accordance with Section 8(6) of the DPDP Act, notify the Data Protection Board of India and affected Data Principals in the manner and timeframe prescribed
under the DPDP Rules, including a description of the likely consequences of the breach and the measures taken or proposed to mitigate risk.

10. Data Retention & Erasure
We retain Work Order records, photos, and associated Customer/Technician data only for as long as necessary to fulfil the purposes described in this Policy, or for as long as retention is required to comply
with an applicable law (the “storage limitation” principle under Section 8(7) of the DPDP Act) — for example, service history, audit, dispute resolution, and government-reporting obligations.

Consistent with our internal data-handling practice, records are generally deactivated rather than immediately purged when no longer active (for example, when a Technician or Customer account is
removed) — the record is marked inactive and excluded from active use, but may be retained for the applicable audit/legal retention period described above before final erasure. Where no legal or record
keeping ground for retention applies and you have withdrawn consent or your purpose has been fulfilled, we will erase the personal data (and direct our processors to do the same) as required under Section 8(7).

11. Your Rights as a Data Principal
Under the DPDP Act, subject to applicable exceptions, you have the right to:
(a) Access — obtain a summary of the personal data we hold about you and the processing activities carried out on it (Section 11);

(b) Correction & erasure — request correction of inaccurate/incomplete information, updating of information, or erasure of personal data that is no longer necessary for the purpose it was collected
for (Section 12);

(c) Grievance redressal — raise a grievance regarding how your information has been handled, and have it addressed in a reasonable time (Section 13; see Section 14 below);

(d) Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity (Section 14);

(e) Withdraw consent — as described in Section 5 above.

To exercise these rights, contact us using the details in Section 14. We may need to verify your identity (e.g. via your registered phone number) before actioning a request, and some requests may be limited where retention is required by law (see Section 10).

12. Children’s Data & Age Affirmation
The Platform is not directed at individuals under the age of 18, and Technicians and Supervisors must be at least 18 years old to register — this is verified at onboarding by an Administrator/Supervisor. We do
not knowingly track, profile, or serve targeted advertising to children, consistent with Section 9 of the DPDP Act.

Because Customer complaints are received over WhatsApp using a household or personal phone number, we are not able to independently verify the age of every person who messages our WhatsApp number. By
submitting a Complaint, the sender affirms that they are 18 years of age or older, or that
they are submitting the Complaint with the involvement/consent of a parent or guardian. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that data, save any information required to be retained by law.

13. Cookies & Local Storage
The mobile application (PWA) and web dashboard use browser local storage and session tokens to keep you logged in and to support offline-tolerant behaviour in low-connectivity areas. We do not use third
party advertising cookies or cross-site tracking.

14. Grievance Officer & Escalation to the Data Protection Board
In accordance with the DPDP Act and the Information Technology Act, 2000, questions, requests, or grievances relating to this Privacy Policy may first be directed to our Grievance Officer:

Grievance / Data Protection Officer: [Name Placeholder]
Email: sahdakshyallp@gmail.com
Phone: (+91) 9425301858
Address: SAHADAKSHYA LLP
D5/604 HIG, RUDRAKSH PARK PHASE-2, BAWADIYA KALAN,
BHOPAL, MADHYA PRADESH, 462039,
INDIA

We will endeavour to acknowledge requests within [X] days and respond substantively within [X] days. If you are not satisfied with our response, or do not receive a response within a reasonable time, you have
the right to file a complaint with the Data Protection Board of India, constituted under the DPDP Act, through its prescribed process. [Placeholder: confirm current Data Protection Board complaint procedure/URL once operational, and update this section accordingly.]

15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. Material changes will be notified through the Platform where practicable, and the “Last Updated” date above will be revised accordingly.

16. Governing Law & Jurisdiction
This Policy is governed by the laws of India, including the DPDP Act. Subject to applicable law, the courts at Bhopal, Madhya Pradesh shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.